critical 9.1

CVE-2025-38728 in the critical feed json

smb3: fix for slab out of bounds on mount to ksmbd

published 2025-09-04 14 mo ago modified 2026-10-30 9 d ago also EUVD-2025-26741

cvss: 9.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below):

BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827

CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]

Patch / fix

fixed in 2 distros 5 links 7

Linux Linux 5.15.224, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2, 6.17
Siemens SIMATIC CN 4100 V5.0

debian ubuntu suse opensuse azure linux

linux Debian 12 6.1.153-1
linux Debian 13 6.12.43-1
linux Debian 14 6.16.3-1

debian advisories DEBIAN-CVE-2025-38728

linux Ubuntu 24.04 LTS 6.8.0-100.100
linux-aws Ubuntu 24.04 LTS 6.8.0-1046.49
linux-gcp Ubuntu 24.04 LTS 6.8.0-1047.50
linux-gke Ubuntu 24.04 LTS 6.8.0-1043.48
linux-ibm Ubuntu 24.04 LTS 6.8.0-1044.44
linux-azure Ubuntu 24.04 LTS 6.8.0-1046.52
linux-gkeop Ubuntu 24.04 LTS 6.8.0-1030.33
linux-raspi Ubuntu 24.04 LTS 6.8.0-1047.51

ubuntu advisories UBUNTU-CVE-2025-38728

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-40.1
kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-40.1
kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-39.1
kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-39.1
kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-39.1
kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-39.1.21.16
kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.28.1
kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.28.1

suse advisories SUSE-SU-2026:20845-1 SUSE-SU-2026:20876-1 SUSE-SU-2026:20477-1 SUSE-SU-2026:20498-1 SUSE-SU-2026:0316-1 SUSE-SU-2026:0315-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.8.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.8.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.8.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.8.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.8.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.8.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.8.1
kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.8.1

opensuse advisories openSUSE-SU-2025:20172-1

kernel Azure Linux 3.0 6.6.104.2-1

azure linux advisories AZL-66875

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-38728 updated 2026-11-05 cvss 7.1

kernel: smb3: fix for slab out of bounds on mount to ksmbd

Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: no fix available
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-134-10 updated 2026-05-14 cvss 5.5

Siemens SIMATIC

Siemens SIMATIC CN 4100 < 5.0
affected: fixed in V5.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 24 d ago (2026-10-15)

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

Linux Linux
Siemens SIMATIC CN 4100

Classification

Weakness

CWE-125 Out-of-bounds Read

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2025-38728
NVD CVE-2025-38728

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary